mixdog 1.2.5 → 1.2.6

package/src/runtime/shared/background-tasks.mjs

@@ -7,6 +7,7 @@ import {
 } from './tool-execution-contract.mjs';
 import { presentErrorText } from './err-text.mjs';
 import { clean } from './clean.mjs';
+import { emitSessionActivityChange } from './session-activity-signal.mjs';
 import {
   parseTaskNotification,
   renderTaskCompletionEnvelope,
@@ -104,12 +105,17 @@ function hasScopeCriteria(scope) {
   return Boolean(scope?.callerSessionId || scope?.routingSessionId || scope?.clientHostPid);
 }
 
-function taskMatchesScope(task, options = {}, { includeUnattributed = true } = {}) {
+function taskSessionIdOf(task) {
+  return task.ownerSessionId || task.notifyContext?.callerSessionId || task.notifyContext?.routingSessionId || null;
+}
+
+// `scope` is normalizeTaskScope(options), normalized once per scan by the
+// caller: a scan is O(tasks), and the daemon runs one per session per
+// busy-count, so per-task normalization multiplied into seconds under load.
+function taskMatchesScope(task, scope, { includeUnattributed = true } = {}) {
   if (!task) return false;
-  const scope = normalizeTaskScope(options);
   if (!hasScopeCriteria(scope)) return true;
-  const taskSessionId =
-    task.ownerSessionId || task.notifyContext?.callerSessionId || task.notifyContext?.routingSessionId || null;
+  const taskSessionId = taskSessionIdOf(task);
   const taskClientHostPid = task.clientHostPid || task.notifyContext?.clientHostPid || null;
   // Legacy/unattributed tasks remain visible so old async jobs are still recoverable.
   if (!taskSessionId && !taskClientHostPid) return includeUnattributed;
@@ -127,11 +133,13 @@ function pruneTasks(options = {}) {
   const { force = false, surface } = options;
   const now = Date.now();
   const wanted = clean(surface);
-  for (const [taskId, task] of [...tasks.entries()]) {
+  const scope = normalizeTaskScope(options);
+  // Deleting the entry being visited is safe during Map iteration.
+  for (const [taskId, task] of tasks) {
     if (wanted && task.surface !== wanted) continue;
-    if (!taskMatchesScope(task, options)) continue;
     const finishedAt = task.finishedAtMs || 0;
-    if (force || (finishedAt > 0 && now - finishedAt > TASK_TTL_MS)) tasks.delete(taskId);
+    if (!force && !(finishedAt > 0 && now - finishedAt > TASK_TTL_MS)) continue;
+    if (taskMatchesScope(task, scope)) tasks.delete(taskId);
   }
   if (tasks.size <= MAX_TASKS) return;
   const removable = [...tasks.values()]
@@ -197,6 +205,7 @@ export function registerBackgroundTask({
     notifyOnCancel: notifyOnCancel === true,
   };
   tasks.set(id, task);
+  emitSessionActivityChange(task.ownerSessionId || '');
   return task;
 }
 
@@ -230,38 +239,64 @@ export function getBackgroundTask(taskId, options = {}) {
   if (!task) return null;
   const wanted = clean(options.surface);
   if (wanted && task.surface !== wanted) return null;
-  if (!taskMatchesScope(task, options)) return null;
+  if (!taskMatchesScope(task, normalizeTaskScope(options))) return null;
   return task;
 }
 
+function countsAsActive(task, wanted, awaitedOnly) {
+  return task.status === 'running' && !(awaitedOnly && task.detached === true) && (!wanted || task.surface === wanted);
+}
+
 /** Lifetime signal: a session-owned background task remains live
- * work even while the interactive turn is idle and every view is detached. */
+ * work even while the interactive turn is idle and every view is detached.
+ * `awaitedOnly` leaves out `detached` tasks: processes a finished command
+ * deliberately left running (an app or server it launched), which nothing is
+ * waiting on and which may outlive the session's work by days.
+ * A read: pruning only ever drops finished tasks, which never count here. */
 export function hasActiveBackgroundTasks(options = {}) {
-  pruneTasks(options);
   const wanted = clean(options.surface);
-  return [...tasks.values()].some(
-    (task) =>
-      task.status === 'running' &&
-      (!wanted || task.surface === wanted) &&
-      taskMatchesScope(task, options, { includeUnattributed: false })
-  );
+  const awaitedOnly = options.awaitedOnly === true;
+  const scope = normalizeTaskScope(options);
+  for (const task of tasks.values()) {
+    if (countsAsActive(task, wanted, awaitedOnly) && taskMatchesScope(task, scope, { includeUnattributed: false })) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/** Every owner session `hasActiveBackgroundTasks({ callerSessionId, surface,
+ *  awaitedOnly })` answers true for, from ONE pass over the tasks: a caller
+ *  asking for every session (busy counts, pool rows) scans once instead of
+ *  once per session. */
+export function activeBackgroundTaskSessionIds(options = {}) {
+  const wanted = clean(options.surface);
+  const awaitedOnly = options.awaitedOnly === true;
+  const ids = new Set();
+  for (const task of tasks.values()) {
+    if (!countsAsActive(task, wanted, awaitedOnly)) continue;
+    const sessionId = taskSessionIdOf(task);
+    if (sessionId) ids.add(sessionId);
+  }
+  return ids;
 }
 
 export function listBackgroundTasks(options = {}) {
   const { surface } = options;
   pruneTasks(options);
   const wanted = clean(surface);
+  const scope = normalizeTaskScope(options);
   return [...tasks.values()]
     .filter((task) => !wanted || task.surface === wanted)
-    .filter((task) => taskMatchesScope(task, options))
+    .filter((task) => taskMatchesScope(task, scope))
     .map((task) => taskSummary(task));
 }
 
 export function cleanupBackgroundTasks(options = {}) {
   const wanted = clean(options.surface);
+  const scope = normalizeTaskScope(options);
   const countForSurface = () =>
-    [...tasks.values()].filter((task) => (!wanted || task.surface === wanted) && taskMatchesScope(task, options))
-      .length;
+    [...tasks.values()].filter((task) => (!wanted || task.surface === wanted) && taskMatchesScope(task, scope)).length;
   const before = countForSurface();
   pruneTasks(options);
   const after = countForSurface();
@@ -331,6 +366,7 @@ export function cancelBackgroundTasks(options = {}) {
   const reason = clean(options.reason) || 'cancelled';
   const wanted = clean(options.surface);
   const executionSessionId = clean(options.executionSessionId);
+  const scope = normalizeTaskScope(options);
   let cancelled = 0;
   for (const task of [...tasks.values()]) {
     if (wanted && task.surface !== wanted) continue;
@@ -341,7 +377,7 @@ export function cancelBackgroundTasks(options = {}) {
       // Delegated work executes in its bound session; before binding it still
       // belongs to the registering session. Notification ownership is separate.
       if ((clean(task.meta?.sessionId) || task.ownerSessionId) !== executionSessionId) continue;
-    } else if (!taskMatchesScope(task, options, { includeUnattributed: false })) continue;
+    } else if (!taskMatchesScope(task, scope, { includeUnattributed: false })) continue;
     if (TERMINAL_STATUSES.has(task.status)) {
       if (options.notify === false) silenceCancelledNotification(task);
       continue;
@@ -413,6 +449,7 @@ export function completeBackgroundTask(
   if (error != null) task.error = presentErrorText(error, { surface: task.surface });
   if (resultType) task.resultType = resultType;
   if (instruction) task.notificationInstruction = compactText(instruction, 1_000);
+  emitSessionActivityChange(task.ownerSessionId || '');
   if (notify) {
     task.meta = sanitizeTaskMeta(task.meta);
     notifyTaskCompletion(task, instruction);
@@ -522,6 +559,9 @@ export function renderBackgroundTaskNotification(task) {
       : resultTextForTask(task);
   if (task.surface === 'shell') {
     const parsed = parseTaskNotification(result);
+    // The completion envelope already carries the result (exit code,
+    // duration, output or its summary): deliver it as is.
+    if (parsed?.result) return result;
     return renderShellCompletionNotice({
       jobId: task.taskId,
       status: task.status,

package/src/runtime/shared/child-spawn-gate.mjs

@@ -1,4 +1,4 @@
-import { availableParallelism } from 'node:os';
+import { availableParallelism, totalmem } from 'node:os';
 import { createOwnerFairGate } from './owner-fair-gate.mjs';
 import { currentToolExecutionOwner } from './tool-execution-owner.mjs';
 import { positiveInt } from './numbers.mjs';
@@ -9,8 +9,9 @@ import { positiveInt } from './numbers.mjs';
 // singleton semaphore CAN bound the number of concurrent child processes (rg,
 // mixdog-graph, …) across ALL agents/workers in this daemon.
 //
-// Default: Windows search scales conservatively from 1..4 with CPU count;
-// code-graph remains 1. Other platforms are unbounded. Windows measurements
+// Default: Windows search and code-graph-query scale 2..8 with CPU count;
+// code-graph builds 1..4 with cores and memory. Other platforms bound search
+// only. Windows measurements
 // showed both extremes are poor: cap 1 creates multi-session queue latency,
 // while unbounded multithreaded rg amplifies Defender/process-scan and disk
 // contention. Separate lanes isolate short search from long graph builds.
@@ -28,7 +29,8 @@ function resolveDefaultChildSpawnLaneMaxInflight(
   laneName,
   env = process.env,
   platform = process.platform,
-  parallelism = availableParallelism()
+  parallelism = availableParallelism(),
+  memoryBytes = totalmem()
 ) {
   const lane = _laneName(laneName);
   const laneOverride = positiveInt(env[`MIXDOG_CHILD_SPAWN_${_laneEnvKey(lane)}_MAX_INFLIGHT`]);
@@ -45,13 +47,19 @@ function resolveDefaultChildSpawnLaneMaxInflight(
   // Slots are held only across the spawn itself, so a small cap smooths the
   // AV convoy without limiting how many commands run concurrently.
   if (lane === 'process-spawn') return Math.max(2, Math.min(4, Math.floor(cpus / 6) || 2));
-  // One cold graph build saturates memory/disk; allow a second only on big hosts.
-  if (lane === 'code-graph') return cpus >= 12 ? 2 : 1;
-  if (lane !== 'search') return 1;
-  // Multiple rg processes beat one under multi-session load, but each process
-  // is itself threaded and Defender amplifies excess fan-out. Burst stress
-  // measured cap-4 starvation (find p50 15s at 8 concurrent sessions), so
-  // scale with cores and cap at eight: 4→2, 8→3, 12→4, 18→6, 24+→8.
+  // Graph builds (Worker thread + native walk/parse) hold a slot for seconds
+  // and are memory-heavy: one per 4 cores and per 4 GiB, 1..4. Builds of one
+  // repo are already single-flight (build.mjs); distinct repos are independent.
+  if (lane === 'code-graph') {
+    const memGb = Math.floor((Number(memoryBytes) || 0) / 1024 ** 3);
+    return Math.max(1, Math.min(4, Math.floor(cpus / 4), Math.floor(memGb / 4)));
+  }
+  if (lane !== 'search' && lane !== 'code-graph-query') return 1;
+  // Short read-only walks: rg, and the graph binary's `--manifest` that
+  // validates a cached graph. Multiple processes beat one under multi-session
+  // load, but each is itself threaded and Defender amplifies excess fan-out.
+  // Burst stress measured cap-4 starvation (find p50 15s at 8 concurrent
+  // sessions), so scale with cores and cap at eight: 4→2, 8→3, 12→4, 18→6, 24+→8.
   return Math.max(2, Math.min(8, Math.ceil(cpus / 3)));
 }
 
@@ -87,11 +95,13 @@ function _laneSetting(name, suffix, fallback) {
 // ── Lanes ────────────────────────────────────────────────────────────────
 // Independent optional limits and queues:
 //   'search'     — short-lived rg processes.
-//   'code-graph' — long-lived graph workers / native graph binaries. A cold
-//               graph build can hold its slot for seconds-to-minutes; a
-//               single shared lane would let one build
-//               stall every rg spawn behind it. Separate lanes remove that
-//               starvation class while keeping each spawn family bounded.
+//   'code-graph' — long-lived graph build workers. A cold build can hold its
+//               slot for seconds-to-minutes; a single shared lane would let
+//               one build stall every rg spawn behind it. Separate lanes
+//               remove that starvation class while keeping each spawn
+//               family bounded.
+//   'code-graph-query' — the short read-only manifest walk that validates
+//               a cached graph, so queries never wait behind builds.
 function _makeLane(name) {
   const limit = resolveDefaultChildSpawnLaneMaxInflight(name);
   const queueMax = _laneSetting(name, 'MAX_QUEUE', 1024);

package/src/runtime/shared/config.mjs

@@ -608,7 +608,6 @@ export function updateSectionAsync(section, updater) {
 export const SECRET_ACCOUNTS = Object.freeze({
   agentApiKey: (provider) => `agent.${provider}.apiKey`,
   openaiUsageSessionKey: 'agent.openai.usageSessionKey',
-  opencodeGoConsoleKey: 'agent.opencode-go.consoleKey',
 });
 
 // ── Secret-aware getters ─────────────────────────────────────────────────────
@@ -639,15 +638,6 @@ export function getOpenAIUsageSessionKey() {
   );
 }
 
-export function getOpenCodeGoConsoleKey() {
-  return (
-    process.env.OPENCODE_CONSOLE_API_KEY ||
-    process.env.OPENCODE_GO_CONSOLE_API_KEY ||
-    process.env.MIXDOG_OPENCODE_CONSOLE_API_KEY ||
-    _readSecret(SECRET_ACCOUNTS.opencodeGoConsoleKey)
-  );
-}
-
 /**
  * Persist a secret to the OS keychain. Throws on failure.
  * Never writes to mixdog-config.json.

package/src/runtime/shared/file-lock.mjs

@@ -24,7 +24,13 @@ import { createKeyedSerialQueue } from './keyed-serial-queue.mjs';
 import { sleep, sleepSync } from './sleep.mjs';
 
 const LOCK_WAIT_CODES = new Set(['EEXIST', 'EPERM', 'EACCES', 'EBUSY']);
-export const DEFAULT_BACKOFFS_MS = Object.freeze([25, 50, 100, 200, 400, 800, 1200, 1600]);
+// Cross-process waits must poll (in-process waiters already queue on
+// lockQueue and wake on release). Each sleep is capped at 200 ms: longer
+// sleeps overshoot a release by up to their full length, and the synchronous
+// paths block the event loop for each sleep. The schedule keeps the earlier
+// ~4.2 s total window for rename retries (Windows AV/indexer file holds).
+const RETRY_MAX_MS = 200;
+export const DEFAULT_BACKOFFS_MS = Object.freeze([25, 50, 100, ...Array(20).fill(RETRY_MAX_MS)]);
 const configuredLockTimeoutMs = Number(process.env.MIXDOG_LOCK_TIMEOUT_MS);
 const DEFAULT_LOCK_TIMEOUT_MS =
   Number.isFinite(configuredLockTimeoutMs) && configuredLockTimeoutMs >= 0 ? configuredLockTimeoutMs : 2000;

package/src/runtime/shared/file-permissions-worker.mjs

@@ -0,0 +1,38 @@
+// Worker side of file-permissions.mjs's sync bridge: owner-only enforcement
+// for synchronous callers, through this thread's own long-lived ACL helper.
+// Every request is answered on the port, then the shared counter (slot 0) is
+// bumped and notified so the blocked caller wakes; slot 1 marks this thread
+// gone, slot 2 marks it ready.
+import { workerData } from 'node:worker_threads';
+import { enforceOwnerOnlyAclWin32Async, prewarmOwnerOnlyAclWin32 } from './file-permissions.mjs';
+
+const { port, signal } = workerData;
+
+function wake() {
+  Atomics.add(signal, 0, 1);
+  Atomics.notify(signal, 0);
+}
+
+process.on('exit', () => {
+  Atomics.store(signal, 1, 1);
+  wake();
+});
+
+port.on('message', async (request) => {
+  if (request?.warm === true) {
+    await prewarmOwnerOnlyAclWin32({ bridge: false });
+    return;
+  }
+  let reply;
+  try {
+    await enforceOwnerOnlyAclWin32Async(request.path, { fresh: true });
+    reply = { id: request.id, ok: true };
+  } catch (error) {
+    reply = { id: request.id, ok: false, message: String(error?.message || error), code: error?.code ?? null };
+  }
+  port.postMessage(reply);
+  wake();
+});
+
+Atomics.store(signal, 2, 1);
+wake();

package/src/runtime/shared/file-permissions.d.mts

@@ -1,8 +1,23 @@
 export function enforceOwnerOnlyAclWin32(targetPath: string, options?: { fresh?: boolean }): void;
 
-export function enforceOwnerOnlyAclWin32Async(
-  targetPath: string,
-  options?: { fresh?: boolean }
-): Promise<void>;
+/** Test hook: the live per-process ACL helper, or null. */
+export function ownerOnlyAclHelperForTests(): import('node:child_process').ChildProcess | null;
+
+/** Test/diagnostic hook: helper attachment, pending requests, starts in the restart window. */
+export function ownerOnlyAclHelperStats(): {
+  alive: boolean;
+  pid: number | null;
+  pending: number;
+  recentStarts: number;
+};
+
+/** Non-fresh calls verify (and tighten) the real DACL on every call through a shared helper. */
+export function enforceOwnerOnlyAclWin32Async(targetPath: string, options?: { fresh?: boolean }): Promise<void>;
 
 export function enforceOwnerOnlyDirectoryWin32Async(targetPath: string): Promise<void>;
+
+/** Test hook: synchronous calls skip the sync bridge and use the one-shot update. */
+export function disableOwnerOnlyAclSyncBridgeForTests(): void;
+
+/** Starts this thread's ACL helper and the sync bridge off any write path. Never rejects. */
+export function prewarmOwnerOnlyAclWin32(options?: { bridge?: boolean }): Promise<void>;